2,023 research outputs found

    Dynamic Analysis of Executables to Detect and Characterize Malware

    Full text link
    It is needed to ensure the integrity of systems that process sensitive information and control many aspects of everyday life. We examine the use of machine learning algorithms to detect malware using the system calls generated by executables-alleviating attempts at obfuscation as the behavior is monitored rather than the bytes of an executable. We examine several machine learning techniques for detecting malware including random forests, deep learning techniques, and liquid state machines. The experiments examine the effects of concept drift on each algorithm to understand how well the algorithms generalize to novel malware samples by testing them on data that was collected after the training data. The results suggest that each of the examined machine learning algorithms is a viable solution to detect malware-achieving between 90% and 95% class-averaged accuracy (CAA). In real-world scenarios, the performance evaluation on an operational network may not match the performance achieved in training. Namely, the CAA may be about the same, but the values for precision and recall over the malware can change significantly. We structure experiments to highlight these caveats and offer insights into expected performance in operational environments. In addition, we use the induced models to gain a better understanding about what differentiates the malware samples from the goodware, which can further be used as a forensics tool to understand what the malware (or goodware) was doing to provide directions for investigation and remediation.Comment: 9 pages, 6 Tables, 4 Figure

    Tracking Cyber Adversaries with Adaptive Indicators of Compromise

    Full text link
    A forensics investigation after a breach often uncovers network and host indicators of compromise (IOCs) that can be deployed to sensors to allow early detection of the adversary in the future. Over time, the adversary will change tactics, techniques, and procedures (TTPs), which will also change the data generated. If the IOCs are not kept up-to-date with the adversary's new TTPs, the adversary will no longer be detected once all of the IOCs become invalid. Tracking the Known (TTK) is the problem of keeping IOCs, in this case regular expressions (regexes), up-to-date with a dynamic adversary. Our framework solves the TTK problem in an automated, cyclic fashion to bracket a previously discovered adversary. This tracking is accomplished through a data-driven approach of self-adapting a given model based on its own detection capabilities. In our initial experiments, we found that the true positive rate (TPR) of the adaptive solution degrades much less significantly over time than the naive solution, suggesting that self-updating the model allows the continued detection of positives (i.e., adversaries). The cost for this performance is in the false positive rate (FPR), which increases over time for the adaptive solution, but remains constant for the naive solution. However, the difference in overall detection performance, as measured by the area under the curve (AUC), between the two methods is negligible. This result suggests that self-updating the model over time should be done in practice to continue to detect known, evolving adversaries.Comment: This was presented at the 4th Annual Conf. on Computational Science & Computational Intelligence (CSCI'17) held Dec 14-16, 2017 in Las Vegas, Nevada, US

    Keeping your ion chemistry from a fragmented perspective

    Get PDF
    Ionic liquids (ILs) are an intriguing class of compounds, belonging to a subset of molten ionic salts with melting points near or less than 100 ºC. There has been much excitement and promise in recent years over the possible applications of ILs, such as solvent-free-electrolyte solutions, reusable solvents for carbon dioxide capture, and energetic ionic liquids for use as explosives and propellants. Having intriguingly well-balanced intermolecular and ionic interactions, small changes in quantum-based effects (such as dispersion or charge transfer) can play important roles in IL properties. ILs are thereby challenging to model classically, and require ab initio based methods to be modeled accurately. This dissertation looks at different ab initio based approaches to modeling the interactions found in ionic liquids, and the roles fragmentation methods are filling in moving toward accurate and cost efficient methods for modeling ionic liquids

    A priori testing of sparse adaptive polynomial chaos expansions using an ocean general circulation model database

    Get PDF
    This work explores the implementation of an adaptive strategy to design sparse ensembles of oceanic simulations suitable for constructing polynomial chaos surrogates. We use a recently developed pseudo-spectral algorithm that is based on a direct application of the Smolyak sparse grid formula and that allows the use of arbitrary admissible sparse grids. The adaptive algorithm is tested using an existing simulation database of the oceanic response to Hurricane Ivan in the Gulf of Mexico. The a priori tests demonstrate that sparse and adaptive pseudo-spectral constructions lead to substantial savings over isotropic sparse sampling in the present setting.United States. Office of Naval Research (award N00014-101-0498)United States. Dept. of Energy. Office of Advanced Scientific Computing Research (award numbers DE-SC0007020, DE-SC0008789, and DE-SC0007099)Gulf of Mexico Research Initiative (contract numbers SA1207GOMRI005 (CARTHE) and SA12GOMRI008 (DEEP-C)

    Doctor of Philosophy

    Get PDF
    dissertationThis work analyzes the DNA translocating mechanisms by the “P22-like” bacteriophages Salmonella enterica phage P22 and Shigella flexneri phage Sf6. DNA packaging into virions during assembly and ejection of the DNA into target cells is examined. To explore DNA packaging, interactions of the terminase proteins (TerS and TerL) and their role in recognizing the correct DNA to be packaged are explored experimentally in vivo. Evidence was obtained showing that the N-terminal domain of TerS is involved in the recognition of bacteriophage DNA, and the C-terminal domain of TerS likely interacts with TerL. The P22 pac site was shown to be necessary and sufficient to induce DNA packaging. Additionally, the Sf6 pac site was identified and shown to be similar to the P22 pac site. The phenotypes of a pac-null P22 mutant and mutations that alter TerS were analyzed. For the first time, the pac site was shown to be essential for P22 lytic growth. Mutations altering the TerS protein that affect pac site recognition were shown to be located in various locations on the protein. Additionally, a mutation in terL was also identified that allows normal progeny phage production in the absence of a functional pac site. This is the first evidence that TerL can work in conjunction with TerS to enable DNA recognition. In our studies of DNA ejection from the virion, a number of insights were obtained. The tail needle (gp26 protein) is the plug that keeps the DNA inside the complete virion, while the ejection proteins (gp7, gp20, and gp16) are required to deliver the DNA into the cytoplasm after gp26 release. We found that alterations of the C-terminal protein domain at the tip of the tail needle can have a strong affect on the rate at which DNA is released into the host cytoplasm, indicating that it may serve as a secondary switch controlling DNA delivery. We also examined the numbers and locations of the three different ejection proteins present in the complete P22 virion and found that they occupy space that is also available to the DNA inside the viral head

    Using whole-genome sequences of the LG/J and SM/J inbred mouse strains to prioritize quantitative trait genes and nucleotides

    Get PDF
    Background The laboratory mouse is the most commonly used model for studying variation in complex traits relevant to human disease. Here we present the whole-genome sequences of two inbred strains, LG/J and SM/J, which are frequently used to study variation in complex traits as diverse as aging, bone-growth, adiposity, maternal behavior, and methamphetamine sensitivity. Results We identified small nucleotide variants (SNVs) and structural variants (SVs) in the LG/J and SM/J strains relative to the reference genome and discovered novel variants in these two strains by comparing their sequences to other mouse genomes. We find that 39% of the LG/J and SM/J genomes are identical-by-descent (IBD). We characterized amino-acid changing mutations using three algorithms: LRT, PolyPhen-2 and SIFT. We also identified polymorphisms between LG/J and SM/J that fall in regulatory regions and highly informative transcription factor binding sites (TFBS). We intersected these functional predictions with quantitative trait loci (QTL) mapped in advanced intercrosses of these two strains. We find that QTL are both over-represented in non-IBD regions and highly enriched for variants predicted to have a functional impact. Variants in QTL associated with metabolic (231 QTL identified in an F16 generation) and developmental (41 QTL identified in an F34generation) traits were interrogated and we highlight candidate quantitative trait genes (QTG) and nucleotides (QTN) in a QTL on chr13 associated with variation in basal glucose levels and in a QTL on chr6 associated with variation in tibia length. Conclusions We show how integrating genomic sequence with QTL reduces the QTL search space and helps researchers prioritize candidate genes and nucleotides for experimental follow-up. Additionally, given the LG/J and SM/J phylogenetic context among inbred strains, these data contribute important information to the genomic landscape of the laboratory mouse

    Arms Control in the Third Space Age: Assessing International Efforts to Regulate Military Operations in Outer Space in the “3 C’s” Era

    Get PDF
    Preserving1and protecting the free and open use of outer space benefits all space-faring nations and is vital to U.S. national interests. U.S. military and civil space operations, however, face a number of growing challenges. Several countries possess or are developing means to disrupt or destroy space systems; space debris threatens the safe passage of spacecraft; and outer space is an environment where the United States now competes with a rapidly growing number of other space-faring nations. To remain the world’s preeminent military space power, the United States must consider a variety of means and strategies to address these challenges
    corecore